View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2021-32066 severity important: SUSE including 361 source package names (2.17-17.3:libruby2_5-2_5-2.5.9-4.20.1, 2.17-17.3:ruby2.5-2.5.9-4.20.1, …), 1144 product×package rows across 262 product lines (Container bci/ruby, Container suse/rmt-server, … (262 product lines)): Fixed 981, Known Affected 160, Known Not Affected 3.
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."